@fgv/ts-web-extras 5.1.0-4 → 5.1.0-40

package/dist/ts-web-extras.d.ts

@@ -14,6 +14,7 @@ import { DetailedResult } from '@fgv/ts-utils';
 import { FileTree } from '@fgv/ts-json-base';
 import { Logging } from '@fgv/ts-utils';
 import { Result } from '@fgv/ts-utils';
+import { Uuid } from '@fgv/ts-utils';
 
 /**
  * Browser implementation of `ICryptoProvider` using the Web Crypto API.
@@ -24,7 +25,7 @@ import { Result } from '@fgv/ts-utils';
  *
  * @public
  */
-declare class BrowserCryptoProvider implements ICryptoProvider {
+declare class BrowserCryptoProvider implements CryptoUtils_2.ICryptoProvider {
     private readonly _crypto;
     /**
      * Creates a new {@link CryptoUtils.BrowserCryptoProvider | BrowserCryptoProvider}.
@@ -37,7 +38,7 @@ declare class BrowserCryptoProvider implements ICryptoProvider {
      * @param key - 32-byte encryption key
      * @returns `Success` with encryption result, or `Failure` with an error.
      */
-    encrypt(plaintext: string, key: Uint8Array): Promise<Result<IEncryptionResult>>;
+    encrypt(plaintext: string, key: Uint8Array): Promise<Result<CryptoUtils_2.IEncryptionResult>>;
     /**
      * Decrypts ciphertext using AES-256-GCM.
      * @param encryptedData - Encrypted bytes
@@ -60,12 +61,25 @@ declare class BrowserCryptoProvider implements ICryptoProvider {
      * @returns Success with derived 32-byte key, or Failure with error
      */
     deriveKey(password: string, salt: Uint8Array, iterations: number): Promise<Result<Uint8Array>>;
+    /**
+     * Computes a SHA-256 hash of the given data.
+     * @param data - UTF-8 string to hash
+     * @returns `Success` with hex-encoded hash string, or `Failure` with an error.
+     */
+    sha256(data: string): Promise<Result<string>>;
     /**
      * Generates cryptographically secure random bytes.
      * @param length - Number of bytes to generate
      * @returns Success with random bytes, or Failure with error
      */
     generateRandomBytes(length: number): Result<Uint8Array>;
+    /**
+     * Generates a cryptographically random UUIDv4 using the injected
+     * `Crypto` instance.
+     * @returns `Success` with the generated UUID, or `Failure` if the underlying
+     * `Crypto` instance does not expose `randomUUID`.
+     */
+    generateUuid(): Result<Uuid>;
     /**
      * Encodes binary data to base64 string.
      * @param data - Binary data to encode
@@ -78,6 +92,105 @@ declare class BrowserCryptoProvider implements ICryptoProvider {
      * @returns Success with decoded bytes, or Failure if invalid base64
      */
     fromBase64(base64: string): Result<Uint8Array>;
+    /**
+     * Generates a new asymmetric keypair via Web Crypto.
+     * @param algorithm - The algorithm to use.
+     * @param extractable - Whether the resulting keys may be exported.
+     * @returns `Success` with the generated `CryptoKeyPair`, or `Failure` with an error.
+     */
+    generateKeyPair(algorithm: CryptoUtils_2.KeyPairAlgorithm, extractable: boolean): Promise<Result<CryptoKeyPair>>;
+    /**
+     * Exports a public `CryptoKey` as a JSON Web Key.
+     * @remarks
+     * Rejects non-public keys at runtime. WebCrypto's `exportKey('jwk', ...)`
+     * does not enforce public-vs-private; without this guard a caller that
+     * passed an extractable private key would receive its private fields
+     * (`d`, `p`, `q`, ...) as JWK, defeating the method's name.
+     * @param publicKey - Extractable public key to export.
+     * @returns `Success` with the JWK, or `Failure` if not a public key or if export fails.
+     */
+    exportPublicKeyJwk(publicKey: CryptoKey): Promise<Result<JsonWebKey>>;
+    /**
+     * Imports a public-key JWK as a `CryptoKey` for the requested algorithm.
+     * @param jwk - The JSON Web Key produced by a prior export.
+     * @param algorithm - The algorithm the key was generated for.
+     * @returns `Success` with the imported public `CryptoKey`, or `Failure` with an error.
+     */
+    importPublicKeyJwk(jwk: JsonWebKey, algorithm: CryptoUtils_2.KeyPairAlgorithm): Promise<Result<CryptoKey>>;
+    /**
+     * Exports a public `CryptoKey` as a DER-encoded SPKI blob.
+     * @param publicKey - The public `CryptoKey` to export.
+     * @returns `Success` with the raw SPKI bytes, or `Failure` with error context.
+     */
+    exportPublicKeySpki(publicKey: CryptoKey): Promise<Result<Uint8Array>>;
+    /**
+     * Imports a public key from a DER-encoded SPKI blob.
+     * @param spkiBytes - The raw SPKI bytes.
+     * @param algorithm - The algorithm the key was generated for.
+     * @returns `Success` with the imported public `CryptoKey`, or `Failure` with error context.
+     */
+    importPublicKeySpki(spkiBytes: Uint8Array, algorithm: CryptoUtils_2.KeyPairAlgorithm): Promise<Result<CryptoKey>>;
+    /**
+     * Signs `data` with `privateKey` using the algorithm inferred from the key.
+     * @param privateKey - A signing `CryptoKey` (`'ecdsa-p256'` or `'ed25519'`).
+     * @param data - The bytes to sign.
+     * @returns `Success` with the raw signature bytes, or `Failure` with error context.
+     */
+    sign(privateKey: CryptoKey, data: Uint8Array): Promise<Result<Uint8Array>>;
+    /**
+     * Verifies a signature produced by {@link BrowserCryptoProvider.sign}.
+     * @param publicKey - A verify `CryptoKey` (`'ecdsa-p256'` or `'ed25519'`).
+     * @param signature - The raw signature bytes.
+     * @param data - The original data that was signed.
+     * @returns `Success` with `true` if valid, `false` if not, or `Failure` with error context.
+     */
+    verify(publicKey: CryptoKey, signature: Uint8Array, data: Uint8Array): Promise<Result<boolean>>;
+    /**
+     * Compares two byte arrays in constant time.
+     *
+     * Accumulates XOR differences with bitwise-OR; no early-return is possible
+     * once the length check passes, making timing independent of the byte
+     * values. Returns `false` immediately on length mismatch (length is not
+     * secret in normal use).
+     * @param a - First byte array.
+     * @param b - Second byte array.
+     * @returns `true` if lengths match and all bytes are equal, `false` otherwise.
+     */
+    timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+    /**
+     * Computes an HMAC-SHA256 MAC for `data` using `key`.
+     * @param key - An HMAC `CryptoKey` with `'sign'` usage.
+     * @param data - The bytes to authenticate.
+     * @returns `Success` with the 32-byte MAC, or `Failure` with error context.
+     */
+    hmacSha256(key: CryptoKey, data: Uint8Array): Promise<Result<Uint8Array>>;
+    /**
+     * Verifies an HMAC-SHA256 MAC in constant time.
+     * @param key - An HMAC `CryptoKey` with `'sign'` usage.
+     * @param signature - The MAC bytes to verify.
+     * @param data - The original data that was authenticated.
+     * @returns `Success` with `true` if valid, `false` if not, or `Failure` with error context.
+     */
+    verifyHmacSha256(key: CryptoKey, signature: Uint8Array, data: Uint8Array): Promise<Result<boolean>>;
+    /**
+     * Wraps `plaintext` for the holder of `recipientPublicKey` using
+     * ECIES (ECDH P-256 + HKDF-SHA256 + AES-GCM-256). See
+     * {@link CryptoUtils.ICryptoProvider.wrapBytes | ICryptoProvider.wrapBytes}.
+     * @param plaintext - The bytes to wrap.
+     * @param recipientPublicKey - The recipient's ECDH P-256 public `CryptoKey`.
+     * @param options - HKDF salt and info; see {@link CryptoUtils.IWrapBytesOptions | IWrapBytesOptions}.
+     * @returns `Success` with the wrapped payload, or `Failure` with an error.
+     */
+    wrapBytes(plaintext: Uint8Array, recipientPublicKey: CryptoKey, options: CryptoUtils_2.IWrapBytesOptions): Promise<Result<CryptoUtils_2.IWrappedBytes>>;
+    /**
+     * Unwraps a payload produced by `wrapBytes` using the recipient's private
+     * key. See {@link CryptoUtils.ICryptoProvider.unwrapBytes | ICryptoProvider.unwrapBytes}.
+     * @param wrapped - The wrapped payload.
+     * @param recipientPrivateKey - The recipient's ECDH P-256 private `CryptoKey`.
+     * @param options - HKDF salt and info matching the wrap call.
+     * @returns `Success` with the original `plaintext`, or `Failure` with an error.
+     */
+    unwrapBytes(wrapped: CryptoUtils_2.IWrappedBytes, recipientPrivateKey: CryptoKey, options: CryptoUtils_2.IWrapBytesOptions): Promise<Result<Uint8Array>>;
 }
 
 /**
@@ -113,9 +226,13 @@ declare function createBrowserCryptoProvider(): Result<BrowserCryptoProvider>;
 
 declare namespace CryptoUtils {
     export {
+        HpkeProvider,
+        IHpkeSealResult,
         BrowserHashProvider,
         createBrowserCryptoProvider,
-        BrowserCryptoProvider
+        BrowserCryptoProvider,
+        IIdbPrivateKeyStorageCreateParams,
+        IdbPrivateKeyStorage
     }
 }
 export { CryptoUtils }
@@ -124,13 +241,13 @@ export { CryptoUtils }
  * Default IndexedDB database name for directory handles.
  * @public
  */
-export declare const DEFAULT_DIRECTORY_HANDLE_DB = "chocolate-lab-storage";
+export declare const DEFAULT_DIRECTORY_HANDLE_DB: string;
 
 /**
  * Default IndexedDB store name for directory handles.
  * @public
  */
-export declare const DEFAULT_DIRECTORY_HANDLE_STORE = "directory-handles";
+export declare const DEFAULT_DIRECTORY_HANDLE_STORE: string;
 
 /**
  * Default initialization parameters for a `FileTree` using {@link FileApiTreeAccessors}.
@@ -229,7 +346,7 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
   * Supports File API (FileList) and File System Access API handles.
   * @public
   */
- export declare class FileApiTreeAccessors<TCT extends string = string> {
+ export declare class FileApiTreeAccessors {
      /**
       * Create a persistent FileTree from a File System Access API directory handle.
       * Changes to files can be synced back to disk.
@@ -325,7 +442,7 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
      static getOriginalFile(fileList: FileList, targetPath: string): Result<File>;
      /**
       * Extract file metadata from a File.
-      * @param fileList - The File to extract metadata from
+      * @param file - The File to extract metadata from
       * @returns The {@link IFileMetadata | file metadata}
       */
      static extractFileMetadata(file: File): IFileMetadata;
@@ -651,6 +768,14 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
   */
  declare function getOriginalFile(fileList: FileList, path: string): Result<File>;
 
+ /**
+  * HPKE base mode (RFC 9180) — `DHKEM(X25519, HKDF-SHA256) + HKDF-SHA256 + AES-256-GCM`.
+  * Re-exported from `@fgv/ts-extras` for browser consumers.
+  * @see {@link CryptoUtils.HpkeProvider}
+  * @public
+  */
+ declare const HpkeProvider: typeof CryptoUtils_2.HpkeProvider;
+
  /**
   * HTTP-backed file tree accessors that cache data in memory and persist via REST API.
   * @public
@@ -686,6 +811,12 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
       */
      syncToDisk(): Promise<Result<void>>;
      private _doSync;
+     /**
+      * Restores snapshotted items back into the live dirty sets so they
+      * are retried on the next sync attempt. Items that were added to
+      * the live sets while the sync was in flight are preserved.
+      */
+     private _restoreUnsynced;
      /**
       * Checks if there are any dirty files that need synchronization.
       * @returns True if there are dirty files, false otherwise.
@@ -739,7 +870,70 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
      private static _requestWithParams;
  }
 
- declare type ICryptoProvider = CryptoUtils_2.ICryptoProvider;
+ /**
+  * {@link CryptoUtils.KeyStore.IPrivateKeyStorage | IPrivateKeyStorage}
+  * implementation backed by IndexedDB. Stores `CryptoKey` objects directly via
+  * IndexedDB's structured-clone serialization — no JWK round-trip — so it works
+  * with non-extractable keys.
+  *
+  * `supportsNonExtractable` is `true`: because the `CryptoKey` is stored by
+  * reference (structured clone) rather than exported, the keystore may generate
+  * `extractable: false` keys for maximum security on browsers that support it.
+  *
+  * The database is opened lazily on first use and cached. Each operation runs in
+  * its own transaction, relying on IndexedDB's default serialization. Multi-tab
+  * concurrency is a known limitation: two tabs writing the same id can race; this
+  * implementation targets single-tab use.
+  *
+  * @public
+  */
+ declare class IdbPrivateKeyStorage implements CryptoUtils_2.KeyStore.IPrivateKeyStorage {
+     /**
+      * `true` — IndexedDB stores `CryptoKey` objects directly, so non-extractable
+      * keys are supported.
+      */
+     readonly supportsNonExtractable: true;
+     private readonly _factory;
+     private readonly _databaseName;
+     private readonly _storeName;
+     private _db;
+     private constructor();
+     /**
+      * Creates a new {@link CryptoUtils.IdbPrivateKeyStorage}.
+      * @param params - Optional {@link CryptoUtils.IIdbPrivateKeyStorageCreateParams}.
+      * @returns `Success` with the new instance, or `Failure` if no IndexedDB
+      * factory is available.
+      */
+     static create(params?: IIdbPrivateKeyStorageCreateParams): Result<IdbPrivateKeyStorage>;
+     /**
+      * Stores `key` under `id`.
+      * @param id - Storage handle to write under.
+      * @param key - The private `CryptoKey` to persist.
+      */
+     store(id: string, key: CryptoKey): Promise<Result<string>>;
+     /**
+      * Loads the private key stored under `id`.
+      * @param id - Storage handle to look up.
+      */
+     load(id: string): Promise<Result<CryptoKey>>;
+     /**
+      * Deletes the entry stored under `id`. Missing ids fail, mirroring the
+      * encrypted-file backend. The existence check and the delete run in separate
+      * transactions (single-tab assumption).
+      * @param id - Storage handle to remove.
+      */
+     delete(id: string): Promise<Result<string>>;
+     /**
+      * Lists every stored id.
+      */
+     list(): Promise<Result<readonly string[]>>;
+     private _getRaw;
+     private _openDb;
+     private _open;
+     private _withStore;
+     private _request;
+     private _awaitCompletion;
+ }
 
  /**
   * Tree initializer for File System Access API directory handles.
@@ -751,8 +945,6 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
      readonly nonRecursive?: boolean;
  }
 
- declare type IEncryptionResult = CryptoUtils_2.IEncryptionResult;
-
  /**
   * Tree initializer for File System Access API file handles.
   * @public
@@ -820,6 +1012,12 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
      showSaveFilePicker(options?: ShowSaveFilePickerOptions): Promise<FileSystemFileHandle_2>;
  }
 
+ /**
+  * Output of `HpkeProvider.sealBase`. Re-exported from `@fgv/ts-extras`.
+  * @public
+  */
+ declare type IHpkeSealResult = CryptoUtils_2.IHpkeSealResult;
+
  /**
   * Configuration for creating HTTP-backed tree accessors.
   * @public
@@ -833,6 +1031,27 @@ declare function extractFileListMetadata(fileList: FileList): Array<IFileMetadat
      readonly logger?: Logging.LogReporter<unknown>;
  }
 
+ /**
+  * Parameters for {@link CryptoUtils.IdbPrivateKeyStorage.create}.
+  * @public
+  */
+ declare interface IIdbPrivateKeyStorageCreateParams {
+     /**
+      * IndexedDB database name. Default: `'fgv-keystore-private-keys'`.
+      */
+     readonly databaseName?: string;
+     /**
+      * IndexedDB object-store name. Default: `'privateKeys'`.
+      */
+     readonly storeName?: string;
+     /**
+      * IndexedDB factory to use. Defaults to `globalThis.indexedDB`. Supplied
+      * explicitly in tests (e.g. a `fake-indexeddb` factory) or to target a
+      * non-default factory.
+      */
+     readonly indexedDB?: IDBFactory;
+ }
+
  /**
   * Configuration for LocalStorageTreeAccessors.
   * @public

package/dist/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.57.7"
+      "packageVersion": "7.58.9"
     }
   ]
 }

package/eslint.config.js

@@ -0,0 +1,32 @@
+// ESLint 9 flat config
+const nodeProfile = require('@rushstack/eslint-config/flat/profile/node');
+const packletsPlugin = require('@rushstack/eslint-config/flat/mixins/packlets');
+const tsdocPlugin = require('@rushstack/eslint-config/flat/mixins/tsdoc');
+
+module.exports = [
+  ...nodeProfile,
+  packletsPlugin,
+  ...tsdocPlugin,
+  {
+    rules: {
+      '@rushstack/packlets/mechanics': 'warn'
+    }
+  },
+  {
+    // file-api-types/ deliberately mirrors the browser File System Access API.
+    // Interface names match the DOM verbatim (no `I` prefix) and some APIs return `null`.
+    files: ['src/packlets/file-api-types/**/*.ts'],
+    rules: {
+      '@typescript-eslint/naming-convention': 'off',
+      '@rushstack/no-new-null': 'off'
+    }
+  },
+  {
+    // MockStorage implements the browser Storage interface (localStorage), which
+    // declares `getItem(key)` and `key(index)` as returning `string | null`.
+    files: ['src/test/unit/localStorageTreeAccessors.test.ts'],
+    rules: {
+      '@rushstack/no-new-null': 'off'
+    }
+  }
+];

package/lib/packlets/crypto-utils/browserCryptoProvider.d.ts

@@ -1,7 +1,5 @@
-import { Result } from '@fgv/ts-utils';
+import { Result, Uuid } from '@fgv/ts-utils';
 import { CryptoUtils } from '@fgv/ts-extras';
-type ICryptoProvider = CryptoUtils.ICryptoProvider;
-type IEncryptionResult = CryptoUtils.IEncryptionResult;
 /**
  * Browser implementation of `ICryptoProvider` using the Web Crypto API.
  * Uses AES-256-GCM for authenticated encryption.
@@ -11,7 +9,7 @@ type IEncryptionResult = CryptoUtils.IEncryptionResult;
  *
  * @public
  */
-export declare class BrowserCryptoProvider implements ICryptoProvider {
+export declare class BrowserCryptoProvider implements CryptoUtils.ICryptoProvider {
     private readonly _crypto;
     /**
      * Creates a new {@link CryptoUtils.BrowserCryptoProvider | BrowserCryptoProvider}.
@@ -24,7 +22,7 @@ export declare class BrowserCryptoProvider implements ICryptoProvider {
      * @param key - 32-byte encryption key
      * @returns `Success` with encryption result, or `Failure` with an error.
      */
-    encrypt(plaintext: string, key: Uint8Array): Promise<Result<IEncryptionResult>>;
+    encrypt(plaintext: string, key: Uint8Array): Promise<Result<CryptoUtils.IEncryptionResult>>;
     /**
      * Decrypts ciphertext using AES-256-GCM.
      * @param encryptedData - Encrypted bytes
@@ -47,12 +45,25 @@ export declare class BrowserCryptoProvider implements ICryptoProvider {
      * @returns Success with derived 32-byte key, or Failure with error
      */
     deriveKey(password: string, salt: Uint8Array, iterations: number): Promise<Result<Uint8Array>>;
+    /**
+     * Computes a SHA-256 hash of the given data.
+     * @param data - UTF-8 string to hash
+     * @returns `Success` with hex-encoded hash string, or `Failure` with an error.
+     */
+    sha256(data: string): Promise<Result<string>>;
     /**
      * Generates cryptographically secure random bytes.
      * @param length - Number of bytes to generate
      * @returns Success with random bytes, or Failure with error
      */
     generateRandomBytes(length: number): Result<Uint8Array>;
+    /**
+     * Generates a cryptographically random UUIDv4 using the injected
+     * `Crypto` instance.
+     * @returns `Success` with the generated UUID, or `Failure` if the underlying
+     * `Crypto` instance does not expose `randomUUID`.
+     */
+    generateUuid(): Result<Uuid>;
     /**
      * Encodes binary data to base64 string.
      * @param data - Binary data to encode
@@ -65,6 +76,105 @@ export declare class BrowserCryptoProvider implements ICryptoProvider {
      * @returns Success with decoded bytes, or Failure if invalid base64
      */
     fromBase64(base64: string): Result<Uint8Array>;
+    /**
+     * Generates a new asymmetric keypair via Web Crypto.
+     * @param algorithm - The algorithm to use.
+     * @param extractable - Whether the resulting keys may be exported.
+     * @returns `Success` with the generated `CryptoKeyPair`, or `Failure` with an error.
+     */
+    generateKeyPair(algorithm: CryptoUtils.KeyPairAlgorithm, extractable: boolean): Promise<Result<CryptoKeyPair>>;
+    /**
+     * Exports a public `CryptoKey` as a JSON Web Key.
+     * @remarks
+     * Rejects non-public keys at runtime. WebCrypto's `exportKey('jwk', ...)`
+     * does not enforce public-vs-private; without this guard a caller that
+     * passed an extractable private key would receive its private fields
+     * (`d`, `p`, `q`, ...) as JWK, defeating the method's name.
+     * @param publicKey - Extractable public key to export.
+     * @returns `Success` with the JWK, or `Failure` if not a public key or if export fails.
+     */
+    exportPublicKeyJwk(publicKey: CryptoKey): Promise<Result<JsonWebKey>>;
+    /**
+     * Imports a public-key JWK as a `CryptoKey` for the requested algorithm.
+     * @param jwk - The JSON Web Key produced by a prior export.
+     * @param algorithm - The algorithm the key was generated for.
+     * @returns `Success` with the imported public `CryptoKey`, or `Failure` with an error.
+     */
+    importPublicKeyJwk(jwk: JsonWebKey, algorithm: CryptoUtils.KeyPairAlgorithm): Promise<Result<CryptoKey>>;
+    /**
+     * Exports a public `CryptoKey` as a DER-encoded SPKI blob.
+     * @param publicKey - The public `CryptoKey` to export.
+     * @returns `Success` with the raw SPKI bytes, or `Failure` with error context.
+     */
+    exportPublicKeySpki(publicKey: CryptoKey): Promise<Result<Uint8Array>>;
+    /**
+     * Imports a public key from a DER-encoded SPKI blob.
+     * @param spkiBytes - The raw SPKI bytes.
+     * @param algorithm - The algorithm the key was generated for.
+     * @returns `Success` with the imported public `CryptoKey`, or `Failure` with error context.
+     */
+    importPublicKeySpki(spkiBytes: Uint8Array, algorithm: CryptoUtils.KeyPairAlgorithm): Promise<Result<CryptoKey>>;
+    /**
+     * Signs `data` with `privateKey` using the algorithm inferred from the key.
+     * @param privateKey - A signing `CryptoKey` (`'ecdsa-p256'` or `'ed25519'`).
+     * @param data - The bytes to sign.
+     * @returns `Success` with the raw signature bytes, or `Failure` with error context.
+     */
+    sign(privateKey: CryptoKey, data: Uint8Array): Promise<Result<Uint8Array>>;
+    /**
+     * Verifies a signature produced by {@link BrowserCryptoProvider.sign}.
+     * @param publicKey - A verify `CryptoKey` (`'ecdsa-p256'` or `'ed25519'`).
+     * @param signature - The raw signature bytes.
+     * @param data - The original data that was signed.
+     * @returns `Success` with `true` if valid, `false` if not, or `Failure` with error context.
+     */
+    verify(publicKey: CryptoKey, signature: Uint8Array, data: Uint8Array): Promise<Result<boolean>>;
+    /**
+     * Compares two byte arrays in constant time.
+     *
+     * Accumulates XOR differences with bitwise-OR; no early-return is possible
+     * once the length check passes, making timing independent of the byte
+     * values. Returns `false` immediately on length mismatch (length is not
+     * secret in normal use).
+     * @param a - First byte array.
+     * @param b - Second byte array.
+     * @returns `true` if lengths match and all bytes are equal, `false` otherwise.
+     */
+    timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean;
+    /**
+     * Computes an HMAC-SHA256 MAC for `data` using `key`.
+     * @param key - An HMAC `CryptoKey` with `'sign'` usage.
+     * @param data - The bytes to authenticate.
+     * @returns `Success` with the 32-byte MAC, or `Failure` with error context.
+     */
+    hmacSha256(key: CryptoKey, data: Uint8Array): Promise<Result<Uint8Array>>;
+    /**
+     * Verifies an HMAC-SHA256 MAC in constant time.
+     * @param key - An HMAC `CryptoKey` with `'sign'` usage.
+     * @param signature - The MAC bytes to verify.
+     * @param data - The original data that was authenticated.
+     * @returns `Success` with `true` if valid, `false` if not, or `Failure` with error context.
+     */
+    verifyHmacSha256(key: CryptoKey, signature: Uint8Array, data: Uint8Array): Promise<Result<boolean>>;
+    /**
+     * Wraps `plaintext` for the holder of `recipientPublicKey` using
+     * ECIES (ECDH P-256 + HKDF-SHA256 + AES-GCM-256). See
+     * {@link CryptoUtils.ICryptoProvider.wrapBytes | ICryptoProvider.wrapBytes}.
+     * @param plaintext - The bytes to wrap.
+     * @param recipientPublicKey - The recipient's ECDH P-256 public `CryptoKey`.
+     * @param options - HKDF salt and info; see {@link CryptoUtils.IWrapBytesOptions | IWrapBytesOptions}.
+     * @returns `Success` with the wrapped payload, or `Failure` with an error.
+     */
+    wrapBytes(plaintext: Uint8Array, recipientPublicKey: CryptoKey, options: CryptoUtils.IWrapBytesOptions): Promise<Result<CryptoUtils.IWrappedBytes>>;
+    /**
+     * Unwraps a payload produced by `wrapBytes` using the recipient's private
+     * key. See {@link CryptoUtils.ICryptoProvider.unwrapBytes | ICryptoProvider.unwrapBytes}.
+     * @param wrapped - The wrapped payload.
+     * @param recipientPrivateKey - The recipient's ECDH P-256 private `CryptoKey`.
+     * @param options - HKDF salt and info matching the wrap call.
+     * @returns `Success` with the original `plaintext`, or `Failure` with an error.
+     */
+    unwrapBytes(wrapped: CryptoUtils.IWrappedBytes, recipientPrivateKey: CryptoKey, options: CryptoUtils.IWrapBytesOptions): Promise<Result<Uint8Array>>;
 }
 /**
  * Creates a {@link CryptoUtils.BrowserCryptoProvider | BrowserCryptoProvider} if Web
@@ -73,5 +183,4 @@ export declare class BrowserCryptoProvider implements ICryptoProvider {
  * @public
  */
 export declare function createBrowserCryptoProvider(): Result<BrowserCryptoProvider>;
-export {};
 //# sourceMappingURL=browserCryptoProvider.d.ts.map

package/lib/packlets/crypto-utils/browserCryptoProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browserCryptoProvider.d.ts","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/browserCryptoProvider.ts"],"names":[],"mappings":"AAqBA,OAAO,EAA0B,MAAM,EAAW,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,KAAK,eAAe,GAAG,WAAW,CAAC,eAAe,CAAC;AACnD,KAAK,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,CAAC;AAevD;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAEjC;;;OAGG;gBACgB,SAAS,CAAC,EAAE,MAAM;IAYrC;;;;;OAKG;IACU,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAmD5F;;;;;;;OAOG;IACU,OAAO,CAClB,aAAa,EAAE,UAAU,EACzB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAgD1B;;;OAGG;IACU,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IASvD;;;;;;OAMG;IACU,SAAS,CACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAyC9B;;;;OAIG;IACI,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IAY9D;;;;OAIG;IACI,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM;IASzC;;;;OAIG;IACI,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;CAYtD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAE3E"}
+{"version":3,"file":"browserCryptoProvider.d.ts","sourceRoot":"","sources":["../../../src/packlets/crypto-utils/browserCryptoProvider.ts"],"names":[],"mappings":"AAoBA,OAAO,EAKL,MAAM,EAGN,IAAI,EACL,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAkC7C;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,YAAW,WAAW,CAAC,eAAe;IACvE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAGjC;;;OAGG;gBACgB,SAAS,CAAC,EAAE,MAAM;IAYrC;;;;;OAKG;IACU,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAmDxG;;;;;;;OAOG;IACU,OAAO,CAClB,aAAa,EAAE,UAAU,EACzB,GAAG,EAAE,UAAU,EACf,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAgD1B;;;OAGG;IACU,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAWvD;;;;;;OAMG;IACU,SAAS,CACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAqC9B;;;;OAIG;IACU,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAoB1D;;;;OAIG;IACI,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IAa9D;;;;;OAKG;IACI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC;IAUnC;;;;OAIG;IACI,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM;IASzC;;;;OAIG;IACI,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC;IAiBrD;;;;;OAKG;IACU,eAAe,CAC1B,SAAS,EAAE,WAAW,CAAC,gBAAgB,EACvC,WAAW,EAAE,OAAO,GACnB,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAqBjC;;;;;;;;;OASG;IACU,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAQlF;;;;;OAKG;IACU,kBAAkB,CAC7B,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,WAAW,CAAC,gBAAgB,GACtC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAQ7B;;;;OAIG;IACU,mBAAmB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAUnF;;;;;OAKG;IACU,mBAAmB,CAC9B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,WAAW,CAAC,gBAAgB,GACtC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAiB7B;;;;;OAKG;IACU,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAUvF;;;;;;OAMG;IACU,MAAM,CACjB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,UAAU,EACrB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAQ3B;;;;;;;;;;OAUG;IACI,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO;IAU7D;;;;;OAKG;IACU,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAStF;;;;;;OAMG;IACU,gBAAgB,CAC3B,GAAG,EAAE,SAAS,EACd,SAAS,EAAE,UAAU,EACrB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAM3B;;;;;;;;OAQG;IACU,SAAS,CACpB,SAAS,EAAE,UAAU,EACrB,kBAAkB,EAAE,SAAS,EAC7B,OAAO,EAAE,WAAW,CAAC,iBAAiB,GACrC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;IAoC7C;;;;;;;OAOG;IACU,WAAW,CACtB,OAAO,EAAE,WAAW,CAAC,aAAa,EAClC,mBAAmB,EAAE,SAAS,EAC9B,OAAO,EAAE,WAAW,CAAC,iBAAiB,GACrC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;CAuD/B;AA4CD;;;;;GAKG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAAC,qBAAqB,CAAC,CAE3E"}